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REMARKS 

Reconsideration and allowance of the subject patent application are respectfully 
requested. 

Claims 1, 3-6 and 13 were rejected under 35 U.S.C. Section 101 as allegedly being 
directed to non-statutory subject matter. While not acquiescing in this rejection, independent 
claims 1 and 13 have each been amended to recite a "computer" system. Conforming 
amendments have been made to the claims that depend from claim 1 . These claims are now 
believed to comply with 35 U.S.C. Section 101. 

Claims 1, 3-7 and 9-13 were rejected under 35 U.S.C. Section 103(a) as allegedly being 
made "obvious" by Roberts et al. (US-2004/0088570) in view of Miyata et al. (U.S. - 
2004/0117401). 

As previously discussed, Roberts et al. does not explicitly teach the limitations of claims 
1, 7 and 13 that the factors in dependence on which it is determined whether the file can be 
regarded as safe include "the length of time for which the database indicates that the file has 
been known without malware-containing instances of it being detected." Miyata et al. is alleged 
to teach this limitation and the office action alleges that it would have been obvious to the person 
skilled in the art at the time of the invention to modify Roberts et al. to include this limitation 
from Miyata et al. 

As previously discussed, Miyata et al. relates to a system storing files on a file server 13. 
The file server 13 can issue a scan request to scan server 15 to scan files. This occurs for 
example when the file is opened or closed on request from a client 1 1 . The system avoids the 
need for unnecessary scans by not scanning files when the virus database has not been updated 
since the last time the file has been scanned. This is achieved by comparing the last scan time 
204 of the file stored as an attribute of the file (referred to as X in Fig. 3) with the file update 
time of the virus database 1621 (referred to as Y in Fig. 3) in step 307 of Fig. 3. 

Thus Miyata et al. does not disclose the limitation of the claims of using a factor of "the 
length of time for which the database indicates that the file has been known without malware- 
containing instances of it being detected." None of (a) the last scan time 204 (or X): (b) the last 
update time Y; or (c) the comparison of X with Y in step 307 constitutes such a feature. 
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Considering (a) the last scan time 204 (or X), this is an attribute of the file specifying the 
point in time when the file was last scanned. This is not a "length of time" as required by claims 
1, 7 and 13 because it specifies a point in time and there is no consideration of a length of time. 
For example, the last scan time 204 (or X) is not subtracted from the current time to obtain a 
length of time. Furthermore, the last scan time 204 (or X) is clearly not "the length of time for 
which the database indicates that the file has been known without malware-containing instances 
of it being detected" because it simply indicates when the file was last scanned and without 
giving any indication of how long the file has been known without malware-containing 
instances of it being detected. Even considering for the sake of argument the notional case that 
Miyata et al. did teach comparing the last scan time 204 (or X) with the current time (which it 
does not), this would result in consideration of the length of time since the file was last scanned, 
which is not the length of time recited in the claims. 

Considering (b) the last update time Y, this simply specifies the point in time when the 
virus database was last updated. This does not constitute the "the length of time for which the 
database indicates that the file has been known without malware-containing instances of it being 
detected" because it concerns the virus database. 

Considering (c) the comparison of X with Y in step 307, this feature of Miyata et al. 
simply involves determining whether the last scan time 204 (or X) is before or after the last 
update time Y. There is no consideration of a "length of time" as required by the claims 1, 7 and 
13 because Miyata et al. is simply determining whether one point in time occurs before or after 
another. Indeed the lengths of time are irrelevant to this comparison in Miyata et al. The result 
of the comparison can be positive (if X<Y) or negative (if X>Y) regardless of the length of time 
between the last scan time 204 (or X) and the current time being large or small. Similarly, the 
result of the comparison can be positive (if X<Y) or negative (if X>Y) regardless of the length of 
time between X and Y being large or small. Thus, Miyata et al. does not teach any consideration 
whatsoever of the limitation of "the length of time for which the database indicates that the file 
has been known without malware-containing instances of it being detected." 

To the contrary, the teaching of Miyata et al. is simply that if the virus database has not 
been updated (as indicated by the last update time Y) since the file was last scanned (as indicated 
by the last scan time 204 or X), then it is not necessary to perform a subsequent scan of the file. 
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Thus Miyata et al. does not consider the claimed feature that "the length of time for 
which the database indicates that the files have been known without malware-containing 
instances of it being detected" can be used as the basis for determining that the file is regarded to 
be safe and hence subject, for example, to less thorough processing. 

In the Response to Arguments in paragraph 5, the office action disagrees with the above 

arguments and contends that Miyata et al. teaches the claim limitation missing from Roberts et 

al. Specifically, the office action argues: 

In paragraph 26 [of Miyata et al], x indicates a last scan time, paragraph 26, y 
indicates the last update time of the virus database, paragraph 27, if x>y file is not 
scanned because virus free, if last scan time of the file > last update of the virus 
database time then there is no virus. A comparison of the timestamps must be 
performed. The difference between the two times is generated to determine a 
result which would be the length of time the file is without malware. 

As should be clear from the above, Applicant does not contest the observation in the 
office action that Miyata et al. discloses comparing X and Y. However, this does not mean that 
Miyata et al. discloses the relevant limitation of "the length of time for which the database 
indicates that the file has been known without malware-containing instances of it being 
detected." 

Consequently, Applicant respectfully submits that the finding in the office action that 

Miyata et al. discloses that "the difference between the two times is generated to determine a 

result which would be the length of time is without malware" is incorrect. This is simply not 

disclosed in Miyata et al. The relevant paragraph [0027] reads: 

Scan server 15 receives the inquiry about Y. CPU 152 reads Y from storage 
device 162 and responds to host 13 (step 305). Host 13 receives the response 
(step 306). CPU 132 compares X with Y (step 307). If X is earlier than Y 
(X<Y), F has been scanned before virus database 1621 has been updated. As a 
result, F may be infected with the newest virus. CPU 152 scans F (step 308). The 
scanning details are described in FIG. 4. CPU 152 notifies host 13 of the scan 
result (step 309). If X is later than Y, no scan is needed. CPU 132 opens F (step 
312). 

Applicant respectfully submits that this paragraph plainly contains no disclosure of 
generating a difference between the two times X and Y. The comparison in step 307 is simply to 
determine whether X>Y or vice versa. Such comparison does not imply generation of the 
difference (X-Y). As would be understood by one of ordinary skill in the fields of logic and 
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computer programming, testing whether X>Y produces a binary true/false output, not a 
difference. Thus, contrary to the assertions in the office action, Miyata et al. does not disclose 
generation or use of any "length of time". 

Miyata et al. simply regards the file as safe if X>Y on the basis that this means the file 
has not been updated since the file was scanned. The purpose of does not require or suggest 
knowledge of the difference (length of time) between X and Y. To achieve the purposes of 
Miyata et al., it is sufficient to know that X>Y, regardless of the magnitude of the difference. In 
the context of Miyata et al., the length of time between the last scan time X and the last update 
Y, be it only a few seconds or many years or anything in between, is irrelevant. This contrasts 
significantly with the claimed subject matter. 

As discussed above, Applicant submits that the rejection is improper because Miyata et 
al. does not teach the limitation asserted in the office action. Thus, it is not necessary to address 
the additional argument in the office action that it would have been obvious to modify Roberts et 
al. to include such a limitation from Miyata et al. However, the absence of argument on this 
point should not be taken as acceptance that it is obvious to modify any teaching of Roberts et al. 
by any teachings of Miyata et al. 

The rejection of dependent claims 3-6 and 9-12 is respectfully traversed at least because 
of the dependencies of these claims on one or the other of claims 1 and 7. 

The pending claims are believed to be allowable and favorable office action is 
respectfully requested. 
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